Zenity Labs published research it calls AgentCorruption, dated 8 October 2026, about Amazon Bedrock AgentCore.

The chain begins with one prompt. A public-facing agent was asked, in conversation, to query the instance metadata service. It did, and returned its own execution-role credentials.

Those credentials belonged to a default IAM role whose permissions covered every AgentCore resource in the account and region, not just the agent that handed them over. With them the researchers enumerated other agents, pulled their container images from ECR, read conversations, planted memories, and reached secrets in Secrets Manager. Zenity demonstrated this inside a single account and region and did not establish access across unrelated customer accounts.

AWS says this is not a vulnerability. Its position is that the research "inaccurately paints expected and documented behaviour as a vulnerability", and that cross-account access requires explicit grants on both the execution role and the target resource.

Both of them are right

That is the interesting part, and it is why this is worth more than a news item.

AWS is correct. A default execution role with permissions scoped to a region is documented. Reading from the instance metadata service is documented. Nothing in the chain exploits a flaw in the sense that a buffer overflow is a flaw. Every component did exactly what its documentation says it does.

Zenity is also correct. The documented permission scope was written for a component that holds a credential and uses it. An agent is a component that holds a credential and explains itself to strangers on request. Put the same IAM role behind the new component and the documented blast radius becomes a one-prompt blast radius.

The disagreement is not really about facts. It is about whether "documented" is a defence when the thing being documented has changed character.

The assumption nobody wrote down

Cloud IAM has an unstated premise running through all of it: the workload holding a credential will not disclose the credential. Not because it is forbidden, but because a web server has no mechanism for being talked into it. You can exploit a web server into leaking a credential, but you cannot ask it nicely.

A language model has exactly that mechanism, and it is the product feature. Instruction-following is the thing being sold.

So a permission boundary that was conservative for a decade is now generous, without anybody changing it. The documentation is accurate and the risk model underneath it has quietly inverted. That is a harder problem than a CVE, because there is nothing to patch and no version number to move past.

What this means in practice

The actionable version, which neither party frames this way:

  • Scope execution roles to the agent, not the region. The default is the problem, and the default is what most deployments keep.
  • Treat an agent's identity as reachable by anybody who can talk to the agent. If the agent is public-facing, assume its credentials are public-facing.
  • Assume metadata service access is credential disclosure on any component that can be prompted.
  • Separate agents by account, not just by role, where the data warrants it. AWS's own answer points this way: cross-account needs explicit grants, so the account boundary is the one that held.

The last point is the only genuinely reassuring thing in the story. The blast radius stopped at the account, and it stopped because of a boundary that was designed to be unambiguous rather than one that depended on how a component behaves.

What is not established

  • When each fix shipped. Accounts differ: one says AWS moved AgentCore to IMDSv2 by February 2026 after a December 2025 disclosure, another says the metadata exposure was fixed in February and the broader permission problem in late September.
  • Whether AWS considers any part of the chain fixed, given that it describes the behaviour as expected.
  • Whether this was ever exploited outside the research.
  • Zenity's technical report, which was not opened. The chain described here comes from the disclosure page and from reporting of the report.
  • Whether other agent platforms have the same shape. The premise this breaks is not specific to AWS, and nobody appears to have checked the others.